openapi: 3.0.0
info:
  description: Use this REST API to manage your DataStax Astra DB organizations and perform lifecycle actions for your Astra DB databases.</br> </br> To get started, use the /v2/clientIdSecrets endpoints to create a token to authenticate your API calls.
  version: 2.3.0
  title: Astra DevOps Access List Users API
  contact:
    email: ad-astra@datastax.com
servers:
- url: https://api.astra.datastax.com/
security:
- BearerAuth:
  - org-admin
  - org-db-create
  - org-db-terminate
  - org-db-view
  - org-db-expand
  - org-db-suspend
  - org-db-addpeering
  - org-db-readpeering
  - db-keyspace-create
  - db-cql
  - accesslist-write
  - accesslist-read
  - db-manage-privateendpoint
  - db-manage-telemetry
  - db-manage-backupconfiguration
tags:
- name: Users
  description: Use the DevOps Users APIs to manage users in your Astra organization.
paths:
  /v2/organizations/users:
    put:
      tags:
      - Users
      summary: Invite a user to an organization
      description: Invite a user to an organization or resend an invitation with new invitation details, such as an updated expiration
      operationId: inviteUserToOrganization
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserInvite'
      responses:
        '200':
          description: successful operation
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
    get:
      tags:
      - Users
      summary: Get an organization's users
      operationId: getOrganizationUsers
      responses:
        '200':
          description: List of users for the current org
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationUsers'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
  /v2/organizations/users/{userID}:
    get:
      tags:
      - Users
      summary: Get an organization's user
      operationId: getOrganizationUser
      parameters:
      - $ref: '#/components/parameters/UserIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
    delete:
      tags:
      - Users
      summary: Remove or uninvite a user from an organization
      operationId: removeUserFromOrganization
      parameters:
      - $ref: '#/components/parameters/UserIdParam'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
  /v2/organizations/users/{userID}/roles:
    put:
      tags:
      - Users
      summary: Update organization roles for a user
      operationId: UpdateRolesForUserInOrganization
      parameters:
      - $ref: '#/components/parameters/UserIdParam'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleInviteRequest'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
components:
  schemas:
    Role:
      type: object
      description: Details of a user role and its policy details
      properties:
        id:
          type: string
          description: The unique system generated identifier of the role.
        name:
          type: string
          description: The name of the role.
        policy:
          $ref: '#/components/schemas/Policy'
        last_update_datetime:
          type: string
          description: The date and time of the last update on the role.
          format: date-time
        last_update_userid:
          type: string
          description: The userID of the user who last updated the role.
    RoleInviteRequest:
      type: object
      description: The roleInvite model
      required:
      - roles
      properties:
        roles:
          type: array
          items:
            type: string
    UserInvite:
      type: object
      description: The userInvite model
      required:
      - email
      - orgID
      - roles
      properties:
        email:
          type: string
          description: The email of the user being invited
        orgID:
          type: string
          description: The unique system generated identifier of the organization
        roles:
          type: array
          items:
            type: string
    UserResponse:
      type: object
      required:
      - userID
      properties:
        userID:
          type: string
          example: 3476f3bb-10df-4d2f-ac2b-f05c65676724
        email:
          type: string
          example: joe@datastax.com
        status:
          type: string
          description: The status of a user within an organization either active or invited
          example: active
        roles:
          type: array
          description: an array of roles the user belongs to for an organization
          items:
            $ref: '#/components/schemas/Role'
    Policy:
      type: object
      description: A policy for a role in Astra.
      required:
      - description
      - actions
      - effect
      - resources
      properties:
        description:
          description: A description of this policy
          type: string
        resources:
          type: array
          description: The resources this policy can manipulate.
          items:
            type: string
            example: drn:astra:org:__ORG_ID__
        actions:
          type: array
          description: 'The actions this policy can take. Example Actions: ''org-billing-write'' ''db-keyspace-create'''
          items:
            type: string
            enum:
            - db-all-keyspace-create
            - db-all-keyspace-describe
            - db-cql
            - db-graphql
            - db-keyspace-alter
            - db-keyspace-authorize
            - db-keyspace-create
            - db-keyspace-describe
            - db-keyspace-drop
            - db-keyspace-grant
            - db-keyspace-modify
            - db-rest
            - db-table-alter
            - db-table-authorize
            - db-table-create
            - db-table-describe
            - db-table-drop
            - db-table-grant
            - db-table-modify
            - db-table-select
            - db-manage-thirdpartymetrics
            - org-audits-read
            - org-billing-read
            - org-billing-write
            - org-db-addpeering
            - org-db-create
            - org-db-expand
            - org-db-passwordreset
            - org-db-suspend
            - org-db-terminate
            - org-db-view
            - org-external-auth-read
            - org-external-auth-write
            - org-notification-write
            - org-read
            - org-role-delete
            - org-role-read
            - org-role-write
            - org-token-read
            - org-token-write
            - org-user-read
            - org-user-write
            - org-write
        effect:
          type: string
          description: Effect this policy will have on the provided resource
          enum:
          - allow
    Error:
      description: ModelError information that is returned to users
      type: object
      required:
      - id
      - message
      properties:
        ID:
          type: integer
          example: 123
          description: API specific error code
        message:
          type: string
          example: Something is broken
          description: User-friendly description of error
    OrganizationUsers:
      type: object
      required:
      - orgID
      - orgName
      - users
      properties:
        orgID:
          type: string
        orgName:
          type: string
        users:
          type: array
          description: an array of users in the organization
          items:
            $ref: '#/components/schemas/UserResponse'
    Errors:
      description: Errors is a collection of individual Error objects
      type: object
      required:
      - errors
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/Error'
  responses:
    ServerError:
      description: A server error occurred
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Errors'
    Unauthorized:
      description: The user is unauthorized to perform the operation
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Errors'
    Forbidden:
      description: The user is forbidden to perform the operation
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Errors'
    NotFound:
      description: The specified database was not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Errors'
    BadRequest:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Errors'
    NoContent:
      description: The request succeeded and no content is returned in response body
  parameters:
    UserIdParam:
      in: path
      name: userID
      required: true
      schema:
        type: string
      description: ID for the user
  securitySchemes:
    BearerAuth:
      description: An application token must be passed in header in order to access the API. https://docs.datastax.com/en/astra-db-serverless/administration/manage-application-tokens.html
      type: http
      scheme: bearer